CVE-2021-39226: Grafana snapshot authentication bypass, actively exploited
The short version: Grafana — the open-source dashboards and observability platform — lets unauthenticated users reach dashboard snapshots by accessing predictable snapshot paths (CVE-2021-39226), exposing whatever data those snapshots hold. It's in CISA's KEV catalog and exploitation activity is near-certain. Patch and confirm your exposure. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — KEV-listed, unauthenticated, mass-exploited |
| CVSS v3.1 (NVD) | 7.3 — High · AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
| CVSS v2 (NVD) | 6.8 — Medium |
| EPSS | ~99.89% · 99th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediate by 2022-09-15 |
| Known exploited? | Yes — listed in CISA KEV (catalogued as an authentication bypass) |
| Vulnerability type | CWE-862 missing authorization / CWE-287 improper authentication → snapshot data disclosure |
| Requires authenticated session? | No — pre-authentication |
| Affected | Grafana before 7.5.11, and 8.0.0 through 8.1.5 |
| Fixed in | 7.5.11 · 8.1.6 |
What you need to know
Grafana snapshots are keyed by a database identifier, and the literal paths /dashboard/snapshot/:key and /api/snapshots/:key can be reached without authentication. Because the lowest keys are predictable, an unauthenticated attacker can walk through snapshots and read them. Where the public_mode setting is enabled, unauthenticated users can also delete the lowest-keyed snapshot — and the combination of viewing and deleting allows a walk through all snapshot data while destroying it.
Why it's worth prioritizing:
- It's pre-authentication and trivially automated. Predictable keys mean a simple script can enumerate snapshots.
- Snapshots leak operational data. Dashboards often surface internal metrics, hostnames, and business signals never meant to be public.
- It's mass-exploited. CISA KEV lists it and EPSS puts exploitation probability near-certain.
How serious we see it
High — in practice, above the base score.
The NVD scores it 7.3 because each impact is rated "low," but the real-world picture is worse: it's unauthenticated, trivial to automate, KEV-listed, and near-certain on EPSS — CISA catalogues it as an authentication bypass. We rate by how it actually gets used, so an information-exposure bug that's mass-scanned on an internet-facing dashboard earns a High. The bounded, reassuring part is that specific versions are affected, the fixes are published, and exposure is quick to determine.
Recommendations
Straight from Grafana's advisory and CISA:
- Patch now. Upgrade to Grafana 7.5.11 or 8.1.6 (or later).
- Disable snapshot
public_modeunless you have a specific need for it. - Assume snapshots were read; review what they exposed. Treat sensitive data shown in snapshots as potentially disclosed.
- Restrict exposure. Keep Grafana off the open internet where you can; put it behind authentication and network controls.
- Confirm your exposure first. Verify whether you run an internet-facing Grafana and which version.
How BreachRisk sees it
BreachRisk discovers internet-facing Grafana instances from little more than your domain, fingerprints the version, and flags exposure tied to this KEV-listed CVE — pushed to the top of your results because it's actively exploited. Where a bounded, non-disruptive check is safe, BreachRisk confirms the exposure rather than inferring it from a version string alone.
That continuous, attacker's-eye view means an exposed Grafana is already mapped and version-checked, so a mass-exploited flaw like this is a specific finding, not a surprise.